Generate, inspect, and manage SSH public/private key pairs.
low risk
ssh-keygen creates key pairs for passwordless SSH authentication. Ed25519 is the modern standard — shorter, faster, and more secure than RSA. -C adds an identifying comment. -f sets the filename. -R removes stale entries from known_hosts.
| Flag | Meaning |
|---|---|
-t | Key type: ed25519 (recommended), ecdsa, rsa |
-b | Key bits — for RSA: minimum 2048, prefer 4096 |
-C | Comment to identify the key (typically email or hostname) |
-f | Output filename for the key pair |
-N | Passphrase for the private key ('' for none) |
-p | Change the passphrase of an existing private key |
-l | Show fingerprint of a public key file |
-R | Remove a host entry from ~/.ssh/known_hosts |
ssh-keygen -t ed25519 -C 'deploy@prod' -f ~/.ssh/prod_ed25519Generate a named Ed25519 key pair for production deployment · explain & risk-check →ssh-keygen -t rsa -b 4096 -C '[email protected]'Generate a 4096-bit RSA key for legacy system compatibility · explain & risk-check →ssh-keygen -l -f ~/.ssh/id_ed25519.pubDisplay the fingerprint of a public key for verification · explain & risk-check →Always prefer Ed25519: `ssh-keygen -t ed25519` — the public key is 68 characters vs 800+ for RSA-4096, with stronger security properties.
Reference text is hand-written and may be incomplete — check man ssh-keygen for your version. Test destructive commands on a non-production system first.